# SignalRGB driver flaws enable BYOVD attacks

Published: 2026-06-17 · Severity: medium
Canonical: https://vorant.io/reports/37052293-89ff-52dd-bdb0-5a2b70c869b0/signalrgb-driver-flaws-enable-byovd-attacks

> Two vulnerabilities in the SignalRGB kernel driver allow local users to access privileged hardware operations or crash the kernel; version 1.3.7.0 fixes both.

Researchers identified two vulnerabilities in SignalIo.sys, the kernel-mode driver used by the SignalRGB Windows application for RGB lighting control and hardware monitoring. CVE-2026-8049 stems from an overly permissive device object DACL, created without an SDDL security descriptor or FILE_DEVICE_SECURE_OPEN flag, allowing any authenticated local user to open a handle and issue privileged IOCTL commands, including read/write access to PCI configuration space. CVE-2026-8050 covers NULL pointer dereference conditions in seven of sixteen IOCTL handlers, which can be triggered by sending an empty input buffer, causing kernel crashes and denial of service.

While the driver includes a kernel-enforced port whitelist that limits some high-risk I/O operations, the underlying access control weakness still exposes privileged functionality to unprivileged processes, a pattern relevant to Bring Your Own Vulnerable Driver (BYOVD) attack techniques where attackers exploit legitimately signed drivers to gain kernel-level primitives. SignalRGB has released version 1.3.7.0 to remediate both issues. CERT/CC recommends updating to the patched driver, restricting administrative privileges, applying Microsoft's driver block rules, and enabling WDAC or equivalent EDR protections to reduce BYOVD exposure.

This is a vendor-disclosed vulnerability report with no evidence of active exploitation; the primary risk is theoretical abuse by local attackers or potential future incorporation into BYOVD toolkits used by ransomware or other kernel-level attack chains.

## Mentioned in this report

- Vulnerabilities: CVE-2026-8049, CVE-2026-8050

## Detection guidance (public sample)

### SignalRGB Vulnerable Driver Loaded From Non-Standard Path

ATT&CK: T1068

Detects SignalIo.sys being loaded as a kernel driver from a path outside the standard SignalRGB installation directory, a common BYOVD staging pattern where attackers drop a legitimately signed vulnerable driver elsewhere to load it and exploit its permissive DACL for privileged IOCTL access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SignalRGB Vulnerable Driver Loaded From Non-Standard Path
description: Detects loading of the SignalIo.sys kernel driver (used by SignalRGB,
  vulnerable to CVE-2026-8049/8050) from a location other than the standard SignalRGB
  install path. BYOVD attacks typically stage a legitimately signed vulnerable driver
  in a writable or unusual directory before loading it to obtain a privileged kernel
  handle.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \SignalIo.sys
  filter_standard_path:
    ImageLoaded|contains:
    - \Program Files\SignalRGB\
    - \Program Files (x86)\SignalRGB\
  condition: selection and not filter_standard_path
falsepositives:
- Legitimate SignalRGB installations that place the driver in a non-default install
  directory
- Portable or per-user SignalRGB deployments in unusual but legitimate paths
level: high
id: 14418e3f-5582-5762-bb23-e6cb3bec4b30
status: experimental
author: Vorant
```

### Kernel Driver Service Created Pointing to SignalIo.sys Outside Install Directory

ATT&CK: T1211

Detects registration of a kernel-mode driver service whose ImagePath references SignalIo.sys from a path outside the standard SignalRGB installation, indicating an attacker is loading the legitimately signed but vulnerable driver to gain a privileged, undetected kernel primitive (BYOVD). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Kernel Driver Service Created Pointing to SignalIo.sys Outside Install Directory
description: Detects creation of a Windows service configured to load SignalIo.sys
  as a kernel driver (Type=1, kernel driver) from a non-standard path. This mirrors
  the BYOVD pattern of registering a legitimately signed vulnerable driver as a service
  to evade code-signing/EDR checks and obtain kernel-level access via its overly permissive
  device object.
tags:
- attack.defense-evasion
- attack.t1211
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \Services\
    TargetObject|endswith: \ImagePath
    Details|endswith: SignalIo.sys
  filter_standard_path:
    Details|contains:
    - \Program Files\SignalRGB\
    - \Program Files (x86)\SignalRGB\
  condition: selection and not filter_standard_path
falsepositives:
- Legitimate SignalRGB software updates or reinstalls that register the driver service
  from a custom directory
level: high
id: 273ac46a-c9a3-507f-921f-a7e88d4d811c
status: experimental
author: Vorant
```

### Kernel Bugcheck Referencing SignalIo.sys Driver

ATT&CK: T1499

Detects a Windows kernel crash (bugcheck) report naming SignalIo.sys as the faulting module, consistent with triggering the NULL pointer dereference DoS condition (CVE-2026-8050) via malformed IOCTL input to the vulnerable driver. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Kernel Bugcheck Referencing SignalIo.sys Driver
description: Detects Windows Error Reporting bugcheck/crash events that identify SignalIo.sys
  as the faulting driver module. This pattern is consistent with exploitation of the
  NULL pointer dereference IOCTL handler vulnerability (CVE-2026-8050) causing a kernel
  crash / denial of service, as opposed to routine hardware or driver instability
  unrelated to this component.
tags:
- attack.impact
- attack.t1499
logsource:
  product: windows
  category: application
detection:
  selection:
    Provider_Name: Microsoft-Windows-WER-SystemErrorReporting
    EventID: 1001
  driver_match:
    Message|contains: SignalIo.sys
  condition: selection and driver_match
falsepositives:
- Unrelated driver instability coincidentally logged near the same time as SignalRGB
  usage
- Hardware failures unrelated to the SignalIo.sys driver but sharing generic bugcheck
  codes
level: medium
id: be5b9f13-5463-567e-859c-c7f62b410b56
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/380058

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/37052293-89ff-52dd-bdb0-5a2b70c869b0/signalrgb-driver-flaws-enable-byovd-attacks.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup